@sema-agent/core 7.52.0 → 7.53.0

package/dist/core/tool-policy.js

@@ -16,7 +16,7 @@ import { boundInputHashOf } from "./canonical-json.js";
 import { delimitUntrusted, inlineUntrusted, REVIEWER_NOTE_MAX_BODY } from "./untrusted-text.js";
 import { describeRejectedValue } from "./tool-search-setting.js";
 import { egressText, egressThrownText } from "./untrusted-egress.js";
-import { assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS } from "./retired-keys.js";
+import { assertNoRetiredKeys, assertNoRetiredToolPolicyKeys, RETIRED_DECISION_MEMBERS, RETIRED_TOOL_POLICY_KEYS } from "./retired-keys.js";
 import { isEngineRefusal, nestedRecordsOf, receiveContract, receiveNestedRecords, refusedOutOfContract, screenContractValues } from "./decision-receipt.js";
 export { isEngineRefusal } from "./decision-receipt.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "./permission-rules.js";
@@ -148,7 +148,7 @@ export function decisionText(d) {
 }
 const TOOL_POLICY_CARRIED_MEMBERS = ["projection", "pathRules", "writeGuardRows", "nameSets"];
 export function carriedMembersOf(p) {
-    assertNoRetiredToolPolicyKeys(p);
+    assertNoRetiredKeys(p, RETIRED_TOOL_POLICY_KEYS, "ToolPolicy");
     const out = {};
     const carry = (k) => {
         const v = p[k];
@@ -612,8 +612,7 @@ export function combinePolicies(...policies) {
                     continue;
                 }
                 if (d.updatedInput !== undefined) {
-                    const reread = withArgsReading(current, d.updatedInput, signal);
-                    current = Object.freeze(reread !== undefined ? await reread : { ...current, args: d.updatedInput });
+                    current = Object.freeze(await withArgsReading(current, d.updatedInput, signal));
                     rewrite = d;
                     stated = d.action === "allow" ? d.decisionReason : undefined;
                 }
@@ -915,6 +914,13 @@ export function ownArgs(v, root = "args") {
     const copy = tryCloneArgs(v);
     return copy.ok ? ownedCopy(copy.value, root) : { ...copy, reason: `unclonable value: ${copy.reason}` };
 }
+export function ownedReading(read) {
+    return (args) => {
+        const out = read(args);
+        const owned = ownArgs(out);
+        return owned.ok ? owned.value : out;
+    };
+}
 function ownedCopy(fresh, root) {
     const pending = [[fresh, root]];
     for (let next = pending.pop(); next !== undefined; next = pending.pop()) {

package/dist/core/types.d.ts

@@ -18,8 +18,8 @@ export type { PermissionMode } from "./ask-origin.js";
 export type { ToolEffect, ToolContentOrigin, ReversibilityVerdict, ReadRootGrantCandidate, ToolSpec, ToolReturn, NestedUsage, NestedUsageAccum, ToolExecuteContext } from "./tool-spec.js";
 export type { BeforeWriteRequest, BeforeWriteResult, BeforeWriteHook, TrackEditRequest, TrackEditResult, TrackFileEditHook, FileEditedNotice, FileEditedHook, HandsBandOptions } from "./hands-band.js";
 export type { AgentDefinition, SkillSpec } from "./agent-definition.js";
-export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit, McpRevocationLedger, McpMountIdentity, McpToolAxesRead } from "./mcp-server-spec.js";
-export { readMcpToolAxes } from "./mcp-server-spec.js";
+export type { McpServerSpec, A2aServerSpec, McpElicitRequest, McpElicitResponse, OnElicit, McpRevocationLedger, McpMountIdentity, DeclarationFault, DeclarationPathRule, DeclarationRead, ToolAxesRead, ToolAxesSurface } from "./mcp-server-spec.js";
+export { DECLARATION_PATH_RULES, declarationFaultOf, declarerWord, readMcpToolAxes, readToolAxes, receiveDeclaration, toolAxesRefusal } from "./mcp-server-spec.js";
 export type { TaskLimits } from "./task-limits.js";
 export type { TaskStatus, RemoteEnvFailureNote, EffectiveMemoryScopes, TaskResult, HumanReviewGateRow } from "./task-result.js";
 export type { TerminalCause, PausedCause } from "./terminal-cause.js";

package/dist/core/types.js

@@ -1,5 +1,5 @@
 export { MODEL_ROLES } from "./model-seat.js";
-export { readMcpToolAxes } from "./mcp-server-spec.js";
+export { DECLARATION_PATH_RULES, declarationFaultOf, declarerWord, readMcpToolAxes, readToolAxes, receiveDeclaration, toolAxesRefusal } from "./mcp-server-spec.js";
 export { AUTO_MODE_DENY_SOURCES, isAutoModeDenySource } from "./runtime-caps.js";
 export { __resetMalformedDelegationSeatAnnouncement, backgroundChildTerminal, deliverDelegationLifecycle, emitsChildRowFrames, taskStartedFrame } from "./delegation-frames.js";
 export { __resetMalformedNoticeSeatAnnouncement, deliverEngineNotice, owedUserInputCounts, parentLegIds, settleOwedUserInput, undrainedUserInputNotices, USER_INPUT_UNDRAINED_CAUSES, USER_INPUT_UNDRAINED_FAMILIES } from "./engine-notice.js";

package/dist/core/untrusted-text.d.ts

@@ -397,6 +397,12 @@ export declare function defuseControlChars(text: string): string;
  * Defense-in-depth, NOT a guarantee (same posture as the rest of this module).
  */
 export declare function inlineUntrusted(text: string, maxLen?: number): string;
+/** The mark a cut text ends in: {@link inlineUntrusted}'s, and a notice's machine-read rule text's
+ *  ({@link import("./permission-rule-model.js").noticeRuleText}) — one ellipsis, spelled once. */
+export declare const INLINE_TRUNCATION_MARK = "\u2026";
+/** The code points {@link inlineUntrusted} may return beyond its content cap: the one truncation mark. The longest result for a cap
+ *  of `maxLen` is `maxLen` plus this. */
+export declare const INLINE_TRUNCATION_MARK_CODEPOINTS: number;
 /** The per-ENTRY ceiling inside a `ProbeCause` operand family (checkpoint-store's
  *  structured probe account), sized like the descriptor's own `touchedPaths` entries (the same thing
  *  on the same card). Per entry, not per cause: that is the whole point of the structured shape —
@@ -414,6 +420,16 @@ export declare const PROBE_CAUSE_PATH_MAX = 200;
  *  (tools/fs) and must fit every load-bearing part inside this bound, the gate, the persist boundary — and
  *  a value import from tools/fs into checkpoint-store closes an ESM cycle. */
 export declare const PROBE_REASON_MAX = 200;
+/**
+ * Whether `text` is a probe's one-sentence account the engine itself could have minted: every mint passes the sentence through
+ * {@link inlineUntrusted} at {@link PROBE_REASON_MAX}, so the longest one is the cap's content plus the truncation ellipsis
+ * ({@link INLINE_TRUNCATION_MARK_CODEPOINTS}), counted in code points. A host that relays the sentence (`RiskDescriptor.probeReason`,
+ * `AskRequest.probeReason`) and meets a longer one has met text the engine did not mint (a third-party producer, a generation
+ * with another cap) — to be dropped whole, not cut, because a cut is another sentence. The bound lives here once; a host asks, it does not count.
+ * The question is total: a value that is not a string is not a sentence the engine mints (every mint is a string), so it answers
+ * `false` — the relay's answer to it, dropping it whole, is the same as to an over-long one.
+ */
+export declare function isMintableProbeReason(text: unknown): boolean;
 /** The one body bound every "reviewer note" relay passes to {@link delimitUntrusted} — the decider's
  *  free text attached to a deny (sync `AskOutcome.reason` and the durable `ResumeOutcome` `reason`
  *  legs alike). A note is steering, not payload: unbounded it can flood the transcript/context the

package/dist/core/untrusted-text.js

@@ -568,18 +568,23 @@ const LABEL_MAX = 160;
 export function inlineUntrusted(text, maxLen = LABEL_MAX) {
     const oneLine = text.replace(/[\s\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
     const cps = [...oneLine];
-    const capped = cps.length > maxLen ? cps.slice(0, maxLen).join("") + "…" : oneLine;
+    const capped = cps.length > maxLen ? cps.slice(0, maxLen).join("") + INLINE_TRUNCATION_MARK : oneLine;
     const out = neutralizeForFence(capped);
     if (maxLen <= 0)
         return "";
     const outCps = [...out];
-    return outCps.length > maxLen + 1 ? outCps.slice(0, maxLen).join("") + "…" : out;
+    return outCps.length > maxLen + INLINE_TRUNCATION_MARK_CODEPOINTS ? outCps.slice(0, maxLen).join("") + INLINE_TRUNCATION_MARK : out;
 }
+export const INLINE_TRUNCATION_MARK = "…";
+export const INLINE_TRUNCATION_MARK_CODEPOINTS = [...INLINE_TRUNCATION_MARK].length;
 function sanitizeLabel(label) {
     return inlineUntrusted(label, LABEL_MAX);
 }
 export const PROBE_CAUSE_PATH_MAX = 200;
 export const PROBE_REASON_MAX = 200;
+export function isMintableProbeReason(text) {
+    return typeof text === "string" && [...text].length <= PROBE_REASON_MAX + INLINE_TRUNCATION_MARK_CODEPOINTS;
+}
 export const REVIEWER_NOTE_MAX_BODY = 2048;
 export function delimitUntrusted(label, text, maxBody) {
     return delimitUntrustedWithClip(label, text, maxBody).text;

package/dist/core/user-attachment.d.ts

@@ -73,9 +73,20 @@ export type ScreenedUserAttachment = {
     readonly data: string;
     readonly mimeType: string;
 };
-/** The door's refusal: one code, the field named first. */
-export declare function userAttachmentRefusal(field: string, detail: string): Error & {
+/**
+ * The field a refusal names, as one value: `path` is the field path the sentence opens with, and `index` the attachment's
+ * position in the seat (0-based, the `[i]` of that path) — present exactly when the sentence names one attachment; a refusal of
+ * the seat as a whole (not a list, too many, a resume, the window) has no index. Built only by {@link SEAT_REF} /
+ * {@link entryRef} / {@link memberRef}, so the index and the path can never name two attachments.
+ */
+export interface UserAttachmentFieldRef {
+    readonly path: string;
+    readonly index?: number;
+}
+/** The door's refusal: one code, the field named first in the sentence and again in `detail` ({@link UserAttachmentFieldRef}). */
+export declare function userAttachmentRefusal(at: UserAttachmentFieldRef, problem: string): Error & {
     code: "config.user_attachment_invalid";
+    detail: UserAttachmentFieldRef;
 };
 /**
  * The door: screen the seat's value (synchronous; the caller's object is read once, member by member, before the

package/dist/core/user-attachment.js

@@ -24,12 +24,16 @@ export const USER_ATTACHMENT_SEAT = Object.freeze({
     supplies: USER_ATTACHMENT_SUPPLIES,
     limits: Object.freeze({ maxEntries: USER_ATTACHMENTS_MAX, maxRenderedTextChars: MAX_READ_OUTPUT_CHARS }),
 });
-export function userAttachmentRefusal(field, detail) {
-    const e = new Error(`${field}: ${detail}`);
+export function userAttachmentRefusal(at, problem) {
+    const e = new Error(`${at.path}: ${problem}`);
     e.code = "config.user_attachment_invalid";
+    e.detail = { path: at.path, ...(at.index !== undefined ? { index: at.index } : {}) };
     return e;
 }
 const SEAT_FIELD = "TaskSpec.userAttachments";
+const SEAT_REF = { path: SEAT_FIELD };
+const entryRef = (index) => ({ path: `${SEAT_FIELD}[${index}]`, index });
+const memberRef = (at, member) => ({ ...at, path: `${at.path}.${member}` });
 const isPlainObject = (v) => {
     if (v === null || typeof v !== "object" || Array.isArray(v))
         return false;
@@ -45,85 +49,87 @@ export function screenUserAttachments(seat, opts) {
     if (seat === undefined)
         return undefined;
     if (!Array.isArray(seat))
-        throw userAttachmentRefusal(SEAT_FIELD, "must be an array of attachments.");
+        throw userAttachmentRefusal(SEAT_REF, "must be an array of attachments.");
     const entries = [...seat];
     if (entries.length === 0)
         return undefined;
     if (entries.length > USER_ATTACHMENTS_MAX)
-        throw userAttachmentRefusal(SEAT_FIELD, `${entries.length} attachments, over the ${USER_ATTACHMENTS_MAX} one objective may carry.`);
+        throw userAttachmentRefusal(SEAT_REF, `${entries.length} attachments, over the ${USER_ATTACHMENTS_MAX} one objective may carry.`);
     if (opts.resumeLeg)
-        throw userAttachmentRefusal(SEAT_FIELD, "a durable resume continues the parked run and sends no new human message, so it cannot carry attachments — declare them on a new objective.");
-    return entries.map((raw, i) => screenEntry(raw, `${SEAT_FIELD}[${i}]`));
+        throw userAttachmentRefusal(SEAT_REF, "a durable resume continues the parked run and sends no new human message, so it cannot carry attachments — declare them on a new objective.");
+    return entries.map((raw, i) => screenEntry(raw, entryRef(i)));
 }
-function screenLabel(v, field) {
+function screenLabel(v, at) {
     if (typeof v !== "string" || v.length === 0)
-        throw userAttachmentRefusal(field, "must be a non-empty string.");
+        throw userAttachmentRefusal(at, "must be a non-empty string.");
     if (v.length > USER_ATTACHMENT_LABEL_MAX)
-        throw userAttachmentRefusal(field, `${v.length} characters, over the ${USER_ATTACHMENT_LABEL_MAX}-character limit.`);
+        throw userAttachmentRefusal(at, `${v.length} characters, over the ${USER_ATTACHMENT_LABEL_MAX}-character limit.`);
     return v;
 }
-function screenPositiveInt(v, field) {
+function screenPositiveInt(v, at) {
     if (typeof v !== "number" || !Number.isInteger(v) || v < 1)
-        throw userAttachmentRefusal(field, "must be an integer of at least 1.");
+        throw userAttachmentRefusal(at, "must be an integer of at least 1.");
     return v;
 }
-function onlyMembers(o, allowed, field) {
+function onlyMembers(o, allowed, at) {
     for (const k of Object.keys(o))
         if (!allowed.includes(k))
-            throw userAttachmentRefusal(`${field}.${k}`, `is not a member of this attachment (allowed: ${allowed.join(", ")}).`);
+            throw userAttachmentRefusal(memberRef(at, k), `is not a member of this attachment (allowed: ${allowed.join(", ")}).`);
 }
-function screenEntry(raw, field) {
+function screenEntry(raw, at) {
     if (!isPlainObject(raw))
-        throw userAttachmentRefusal(field, "must be a plain object: { path } (a workspace file), { name, text } (host text) or { name, image } (a host image).");
+        throw userAttachmentRefusal(at, "must be a plain object: { path } (a workspace file), { name, text } (host text) or { name, image } (a host image).");
     const arms = ["path", "text", "image"].filter((k) => Object.prototype.hasOwnProperty.call(raw, k));
     const arm = arms[0];
     if (arm === undefined || arms.length !== 1) {
-        throw userAttachmentRefusal(field, arm === undefined ? "names no attachment: give exactly one of `path`, `text` or `image`." : `mixes ${arms.map((a) => `\`${a}\``).join(" and ")}: give exactly one of \`path\`, \`text\` or \`image\`.`);
+        throw userAttachmentRefusal(at, arm === undefined ? "names no attachment: give exactly one of `path`, `text` or `image`." : `mixes ${arms.map((a) => `\`${a}\``).join(" and ")}: give exactly one of \`path\`, \`text\` or \`image\`.`);
     }
     switch (arm) {
         case "path": {
-            onlyMembers(raw, ["path", "lines"], field);
-            const path = screenLabel(raw.path, `${field}.path`);
+            onlyMembers(raw, ["path", "lines"], at);
+            const path = screenLabel(raw.path, memberRef(at, "path"));
             const linesRaw = raw.lines;
             if (linesRaw === undefined)
                 return { supply: "path", path };
+            const linesAt = memberRef(at, "lines");
             if (!isPlainObject(linesRaw))
-                throw userAttachmentRefusal(`${field}.lines`, "must be { start, end? }.");
-            onlyMembers(linesRaw, ["start", "end"], `${field}.lines`);
-            const start = screenPositiveInt(linesRaw.start, `${field}.lines.start`);
+                throw userAttachmentRefusal(linesAt, "must be { start, end? }.");
+            onlyMembers(linesRaw, ["start", "end"], linesAt);
+            const start = screenPositiveInt(linesRaw.start, memberRef(linesAt, "start"));
             const endRaw = linesRaw.end;
             if (endRaw === undefined)
                 return { supply: "path", path, lines: { start } };
-            const end = screenPositiveInt(endRaw, `${field}.lines.end`);
+            const end = screenPositiveInt(endRaw, memberRef(linesAt, "end"));
             if (end < start)
-                throw userAttachmentRefusal(`${field}.lines.end`, `${end} is before the start line ${start}.`);
+                throw userAttachmentRefusal(memberRef(linesAt, "end"), `${end} is before the start line ${start}.`);
             return { supply: "path", path, lines: { start, end } };
         }
         case "text": {
-            onlyMembers(raw, ["name", "text", "startLine"], field);
-            const name = screenLabel(raw.name, `${field}.name`);
+            onlyMembers(raw, ["name", "text", "startLine"], at);
+            const name = screenLabel(raw.name, memberRef(at, "name"));
             const text = raw.text;
             if (typeof text !== "string" || text.length === 0)
-                throw userAttachmentRefusal(`${field}.text`, "must be a non-empty string.");
-            const startLine = raw.startLine === undefined ? 1 : screenPositiveInt(raw.startLine, `${field}.startLine`);
+                throw userAttachmentRefusal(memberRef(at, "text"), "must be a non-empty string.");
+            const startLine = raw.startLine === undefined ? 1 : screenPositiveInt(raw.startLine, memberRef(at, "startLine"));
             const rendered = renderNumbered(text, startLine);
             if (rendered.length > MAX_READ_OUTPUT_CHARS)
-                throw userAttachmentRefusal(`${field}.text`, `renders to ${rendered.length} characters with line numbers, over the ${MAX_READ_OUTPUT_CHARS}-character limit a read may deliver — send a part of it.`);
+                throw userAttachmentRefusal(memberRef(at, "text"), `renders to ${rendered.length} characters with line numbers, over the ${MAX_READ_OUTPUT_CHARS}-character limit a read may deliver — send a part of it.`);
             return { supply: "content_text", name, text, startLine, rendered };
         }
         case "image": {
-            onlyMembers(raw, ["name", "image"], field);
-            const name = screenLabel(raw.name, `${field}.name`);
+            onlyMembers(raw, ["name", "image"], at);
+            const name = screenLabel(raw.name, memberRef(at, "name"));
             const img = raw.image;
+            const imageAt = memberRef(at, "image");
             if (!isPlainObject(img))
-                throw userAttachmentRefusal(`${field}.image`, "must be { data, mimeType } (base64 bytes and the image's type).");
-            onlyMembers(img, ["data", "mimeType"], `${field}.image`);
+                throw userAttachmentRefusal(imageAt, "must be { data, mimeType } (base64 bytes and the image's type).");
+            onlyMembers(img, ["data", "mimeType"], imageAt);
             const data = img.data;
             const mimeType = img.mimeType;
             if (typeof data !== "string" || data.length === 0)
-                throw userAttachmentRefusal(`${field}.image.data`, "must be a non-empty base64 string.");
+                throw userAttachmentRefusal(memberRef(imageAt, "data"), "must be a non-empty base64 string.");
             if (typeof mimeType !== "string" || !ADMITTED_IMAGE_MIME_TYPES.includes(mimeType)) {
-                throw userAttachmentRefusal(`${field}.image.mimeType`, `must be one of ${ADMITTED_IMAGE_MIME_TYPES.join(", ")}.`);
+                throw userAttachmentRefusal(memberRef(imageAt, "mimeType"), `must be one of ${ADMITTED_IMAGE_MIME_TYPES.join(", ")}.`);
             }
             return { supply: "content_image", name, data, mimeType };
         }
@@ -132,7 +138,7 @@ function screenEntry(raw, field) {
 export function refuseUserAttachmentPathsWithoutWorkspace(screened) {
     const i = screened?.findIndex((a) => a.supply === "path") ?? -1;
     if (i >= 0)
-        throw userAttachmentRefusal(`${SEAT_FIELD}[${i}].path`, "this run has no workspace (its hand tools are off), so the engine has no file to read — send the file's bytes as a `text` or `image` entry instead.");
+        throw userAttachmentRefusal(memberRef(entryRef(i), "path"), "this run has no workspace (its hand tools are off), so the engine has no file to read — send the file's bytes as a `text` or `image` entry instead.");
 }
 export function userAttachmentDeclarations(screened) {
     return screened.map((a, i) => a.supply === "path"
@@ -149,16 +155,16 @@ export async function admitUserAttachmentImages(screened) {
             out.set(i + 1, admitted.block);
             continue;
         }
-        const field = `${SEAT_FIELD}[${i}].image`;
+        const imageAt = memberRef(entryRef(i), "image");
         switch (admitted.reason) {
             case "mime_unsupported":
-                throw userAttachmentRefusal(`${field}.mimeType`, `must be one of ${ADMITTED_IMAGE_MIME_TYPES.join(", ")}.`);
+                throw userAttachmentRefusal(memberRef(imageAt, "mimeType"), `must be one of ${ADMITTED_IMAGE_MIME_TYPES.join(", ")}.`);
             case "magic_mismatch":
-                throw userAttachmentRefusal(`${field}.data`, `does not begin with a ${a.mimeType} signature (empty, mis-declared, or not base64) — refused rather than sent.`);
+                throw userAttachmentRefusal(memberRef(imageAt, "data"), `does not begin with a ${a.mimeType} signature (empty, mis-declared, or not base64) — refused rather than sent.`);
             case "raw_too_large":
-                throw userAttachmentRefusal(`${field}.data`, `${admitted.rawBytes} bytes, over the ${admitted.cap}-byte cap.`);
+                throw userAttachmentRefusal(memberRef(imageAt, "data"), `${admitted.rawBytes} bytes, over the ${admitted.cap}-byte cap.`);
             case "base64_too_large":
-                throw userAttachmentRefusal(`${field}.data`, `base64 of ${admitted.base64.length} characters, over the API's 5 MB image limit — shrink the image first.`);
+                throw userAttachmentRefusal(memberRef(imageAt, "data"), `base64 of ${admitted.base64.length} characters, over the API's 5 MB image limit — shrink the image first.`);
         }
     }
     return out;
@@ -395,7 +401,7 @@ function refuseFramesOverWindow(frames, model, window) {
     if (tokens <= budget)
         return;
     const n = frames.length;
-    throw userAttachmentRefusal(SEAT_FIELD, `the ${n} ${n === 1 ? "attachment" : "attachments"} and the objective come to about ${tokens} tokens, over the ${budget} tokens one request can hold on this model — to send it the engine would have to drop the objective or some of the attachments. Nothing was sent; attach fewer or smaller parts.`);
+    throw userAttachmentRefusal(SEAT_REF, `the ${n} ${n === 1 ? "attachment" : "attachments"} and the objective come to about ${tokens} tokens, over the ${budget} tokens one request can hold on this model — to send it the engine would have to drop the objective or some of the attachments. Nothing was sent; attach fewer or smaller parts.`);
 }
 export async function readObjectiveAttachments(prepared, inputId, blocked, window) {
     if (blocked || prepared.userAttachments === undefined)

package/dist/core/wiring-manifest.d.ts

@@ -113,8 +113,7 @@ export interface AutoModeArmFact {
  * One declared MCP server's materialization result for THIS leg — the per-server connection-state
  * read face on {@link WiringManifest.mcp}. `status` is the connect-time verdict of this leg's
  * materialize (a snapshot, never a heartbeat — the same semantics as `MaterializedMcp.statuses`,
- * which it is projected from): `connected` (tools listed; `toolCount` = the mounted roster size after
- * intake), `failed` (the connect or the tool listing threw — `errorCode`/`delivered`/`httpStatus` are the
+ * which it is projected from): `connected` (tools listed; `toolCount` = see the field), `failed` (the connect or the tool listing threw — `errorCode`/`delivered`/`httpStatus` are the
  * failure record spread flat (see the MCP failure vocabulary's `McpFailure`), `error` the
  * neutralized, length-bounded remote text), `skipped` (declared on the spec but this leg produced no
  * status for it — the materialization did not reach it). `source` is the DECLARING side's own label
@@ -130,6 +129,9 @@ export interface WiringManifestMcpEntry {
     delivered?: McpDelivered;
     httpStatus?: number;
     error?: string;
+    /** How many of the server's tools the roster the row is read against holds: a run's roster (the valve and the deployment's
+     *  `toolFaces` overlay applied — a tool either one leaves off is not counted), or, for `probeMcpServers` (no run, so no lists),
+     *  what its own dial would mount. `0` on `failed` and on `skipped` (no connection, so nothing held). */
     toolCount: number;
     /**
      * The engine's last liveness OBSERVATION about this server as of this leg's materialize — a per-leg

package/dist/engine/harness/agent-harness.js

@@ -670,13 +670,14 @@ export class AgentHarness {
                     },
                 };
             },
-            beforeToolCall: async ({ toolCall, args }, signal) => {
+            beforeToolCall: async ({ toolCall, args, readArguments }, signal) => {
                 const result = await this.emitHook({
                     type: "tool_call",
                     toolCallId: toolCall.id,
                     toolName: toolCall.name,
                     input: args,
                     ...(signal !== undefined ? { signal } : {}),
+                    ...(readArguments !== undefined ? { readArguments } : {}),
                 });
                 return result;
             },

package/dist/engine/harness/types.d.ts

@@ -1185,6 +1185,9 @@ export interface ToolCallEvent {
      *  emits that carry no per-call signal; a subscriber gating a wait on it must then fall back to
      *  whatever run-level signal it already holds (the historical shape, byte-identical). */
     signal?: AbortSignal;
+    /** The loop's reading of this call's arguments ({@link BeforeToolCallContext.readArguments}), handed on verbatim: a
+     *  subscriber that rewrites the call reads the rewrite through it before judging it. */
+    readArguments?: (args: unknown) => unknown;
 }
 export interface ToolResultEvent {
     type: "tool_result";

package/dist/engine/loop/agent-loop.d.ts

@@ -23,7 +23,7 @@
  */
 import type { AssistantMessage, ToolResultMessage } from "../llm/index.js";
 import { type AgentCoreStreamRuntimeDeps } from "./runtime-deps.js";
-import type { AfterToolCallResult, AgentContext, AgentEvent, AgentLoopConfig, AgentMessage, AgentToolResult, HaltRemainingDirective, StreamFn } from "./types.js";
+import type { AfterToolCallResult, AgentContext, AgentEvent, AgentLoopConfig, AgentMessage, AgentTool, AgentToolCall, AgentToolResult, HaltRemainingDirective, StreamFn } from "./types.js";
 /** Callback used by synchronous loop runners to publish agent lifecycle events. */
 export type AgentEventSink = (event: AgentEvent) => Promise<void> | void;
 /** Named reasons the loop goes around again. Assertable in tests via the trace sink. */
@@ -159,6 +159,17 @@ export type ExecutedToolCallOutcome = {
     result: AgentToolResult<unknown>;
     isError: boolean;
 };
+/**
+ * THE reading a value gets on its way to becoming a call's arguments: the tool's own preparation (`prepareArguments` —
+ * a default filled in, an alias folded), then the schema's coercions ({@link validateToolArguments}). The loop reads the
+ * model's call through it before the gate, hands the same reading to the gate (`BeforeToolCallContext.readArguments`)
+ * so every rewrite is judged as it will run, and reads the gate's output through the same two steps once more — refusing
+ * an output they would move. A preparation that throws throws here too (the value cannot be read: whoever adopts it
+ * refuses it, as the loop refuses a model call whose preparation throws). A value that does not VALIDATE is handed back as
+ * given: nothing invalid runs (the loop's own reading of the gate's output throws on it), and a judge of it judges bytes
+ * that never execute.
+ */
+export declare function readToolCallArguments(tool: AgentTool, toolCall: AgentToolCall, args: unknown): unknown;
 /**
  * How many tool names an unknown-tool miss spells out. A miss is a NAME problem: seeing a couple of dozen
  * real names is what lets a model spot the one it meant, while a full listing grows with the deployment

package/dist/engine/loop/agent-loop.js

@@ -1215,6 +1215,15 @@ function prepareToolCallArguments(tool, toolCall) {
         arguments: preparedArguments,
     };
 }
+export function readToolCallArguments(tool, toolCall, args) {
+    const prepared = prepareToolCallArguments(tool, { ...toolCall, arguments: structuredClone(args) });
+    try {
+        return validateToolArguments(tool, prepared);
+    }
+    catch {
+        return args;
+    }
+}
 export const ROSTER_LISTING_MAX = 25;
 export const ROSTER_SEARCH_HINT_NAME = "ToolSearch";
 function formatRosterRecovery(availableTools) {
@@ -1332,6 +1341,7 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
                 toolCall,
                 args: finalArgs,
                 context: currentContext,
+                readArguments: (args) => readToolCallArguments(tool, toolCall, args),
             }, signal);
             if (signal?.aborted) {
                 return {
@@ -1347,11 +1357,13 @@ async function prepareToolCall(currentContext, assistantMessage, toolCall, confi
                 }
                 return { kind: "immediate", result: blocked, isError: true };
             }
-            if (beforeResult?.updatedInput !== undefined) {
-                finalArgs = validateToolArguments(tool, {
-                    ...preparedToolCall,
-                    arguments: beforeResult.updatedInput,
-                });
+            const rewritten = beforeResult?.updatedInput;
+            if (rewritten !== undefined) {
+                const judged = structuredClone(rewritten);
+                finalArgs = validateToolArguments(tool, prepareToolCallArguments(tool, { ...preparedToolCall, arguments: structuredClone(judged) }));
+                if (!sameToolArgs(finalArgs, judged)) {
+                    throw new Error(`the arguments cleared for "${tool.name}" are not the ones it would run: its reading of them (argument preparation, schema coercions) changes them, and that form was never judged — not executed`);
+                }
                 if (!sameToolArgs(validatedArgs, finalArgs)) {
                     const rewrittenRefusal = await runInputValidation(tool, finalArgs, toolCall.id, signal, config.onToolInputValidationFault);
                     if (rewrittenRefusal !== undefined)

package/dist/engine/loop/types.d.ts

@@ -64,7 +64,9 @@ export type AgentToolCall = Extract<AssistantMessage["content"][number], {
  * loop replaces the validated args with `updatedInput` and **re-runs `validateToolArguments` on it**
  * before execution, so a rewrite can never carry across schema-invalid args into `tool.execute()`. This is
  * the generic carrier the higher layer uses for arg redaction/clamping (design/37); the loop itself
- * stays policy-agnostic. `block` wins over `updatedInput` if both are set.
+ * stays policy-agnostic. `block` wins over `updatedInput` if both are set. The rewrite must already be in
+ * the form the tool runs (read through {@link BeforeToolCallContext.readArguments}); one that reading would
+ * still move is refused, never silently re-read — what runs is what the gate judged.
  *
  * Keep in sync with the harness hook result `ToolCallResult` (harness/types.ts), which the harness's
  * `beforeToolCall` callback returns verbatim.
@@ -133,6 +135,10 @@ export interface BeforeToolCallContext {
     args: unknown;
     /** Current agent context at the time the tool call is prepared. */
     context: AgentContext;
+    /** The reading the loop gave `args` and will give any `updatedInput`: the tool's `prepareArguments`, then the schema's
+     *  coercions (a value that does not validate comes back as given). A gate that rewrites the call reads the rewrite
+     *  through it before judging it, so what it judges is what runs; the loop refuses an `updatedInput` this reading moves. */
+    readArguments?: (args: unknown) => unknown;
 }
 /** Context passed to `afterToolCall`. */
 export interface AfterToolCallContext {

package/dist/index.d.ts

@@ -112,7 +112,7 @@ export type { RemoteExecutionEnv, WorkspaceHandle, SnapshotId, SessionToken, San
 export { addWorktree, pruneWorktrees, WORKTREE_PARENT, type AddWorktreeOptions } from "./core/git-worktree-env.js";
 export { runExecGate } from "./core/exec-gate.js";
 export type { ExecStep, ExecStepResult, ExecGateResult, ExecGateOptions } from "./core/exec-gate.js";
-export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core/untrusted-text.js";
+export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted, isMintableProbeReason } from "./core/untrusted-text.js";
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, CheckResult, } from "./core/property-harness.js";
@@ -144,7 +144,7 @@ export { DEFAULT_FILE_HISTORY_BOUNDARY_KEEP, resolveFileHistoryRetention, fileHi
 export type { FileHistoryRetentionPolicy } from "./core/file-history-retention.js";
 export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileFileHistoryStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, FileStoreLockError, type FileStoreLockErrorCode, processFingerprint, isProcessLive, type ProcessFingerprint, type FileStorageBackendOptions, type FileStorageCorruptReadInfo, type FileFileHistoryStoreOptions, type FileSessionRepoOptions, type FileCheckpointStoreOptions, } from "./stores/file/index.js";
 export { CacheBreakDetector, type CacheBreakFinding, type ToolFingerprintInput } from "./core/cache-break-detector.js";
-export { maybeCompact, type MaybeCompactOptions, type CompactionWindowSafetyInfo } from "./core/auto-compaction.js";
+export { maybeCompact, type MaybeCompactOptions, type CompactionPassStart, type CompactionWindowSafetyInfo } from "./core/auto-compaction.js";
 export type { CompactionEffect } from "./core/frame-settlement.js";
 export { brainToRuntime } from "./core/runtime.js";
 export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./core/sensitive-path-policy.js";
@@ -277,9 +277,10 @@ export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps,
 export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, // the ONE arming reading (`memory.auto_consolidation.arming_has_one_resolver`) — the seat's absence is not "off"
 type MemoryConsolidationDriverDeps, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, type PromptBlock, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, type PromptBlock, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { OVERLAY_SOURCE_ORDER, type ChainLink as PromptChainLink, type PromptOverlay, type SupersededOverlay } from "./prompt-assembly/overlay.js";
+export { PROMPT_BINDING_LIST_MAX, PROMPT_BINDING_MAX_CHARS } from "./prompt-assembly/overlay.js";
 export { BANDS as PROMPT_BANDS } from "./prompt-assembly/bands.js";
 export { OVERLAY_OPS, HOST_ROLES, HOST_FORMS, type OverlayOp as PromptOverlayOp, type OverlaySource as PromptOverlaySource, type HostRole as PromptHostRole, type HostForm as PromptHostForm, type VariantWhen as PromptVariantWhen } from "./prompt-assembly/catalog/schema.js";
 export { SEMA_DEFAULT_CATALOG, catalogText } from "./prompt-assembly/catalog/index.js";
@@ -288,7 +289,7 @@ export { attachToolContract, getToolContract, hasToolContract, computeShapeDiges
 export { normalizePromptEpoch, promptIdentityOf, PROMPT_EPOCH_ACTIVATIONS, PROMPT_EPOCH_CHANGES, type PromptEpochDescriptor, type PromptEpochActivation, type PromptEpochChange, type PromptIdentityLayers, type StoredPromptEpoch, } from "./prompt-assembly/epoch.js";
 export { ARTIFACT_LIMITS, buildPromptArtifact, computeArtifactDigest, requiresOf, unmetRequirements, verifyPromptArtifact, type ArtifactVerifyCode, type ArtifactVerifyResult, type PromptArtifact, type PromptArtifactEvidence, type PromptArtifactPayload, type PromptArtifactRequires, type PublishedPromptArtifact, } from "./prompt-assembly/artifact.js";
 export { buildTurnPromptSnapshot, loweringRecordFor, LOWERING_VERSION, PREFIX_INPUT_CLASSIFICATION, type CacheIdentityElements, type LoweringRecord, type PrefixInputClass, type RawPrefixInputs, type TurnPromptSnapshot, } from "./prompt-assembly/turn-snapshot.js";
-export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, type PromptArtifactSource, type PromptArtifactStore, type PromptSourceState, type PromptSourceStateStore, } from "./prompt-assembly/artifact-store.js";
+export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, type OnArtifactRefused, type PromptArtifactSource, type PromptArtifactStore, type PromptSourceState, type PromptSourceStateStore, type StoredArtifactRefusal, } from "./prompt-assembly/artifact-store.js";
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn, type CompiledEventPrompt, type EventDedupe, type EventDefaultPolicy } from "./prompt-assembly/event-registry.js";
 export { OUTPUT_STYLE_NAME_MAX } from "./core/output-style.js";
@@ -366,6 +367,11 @@ export { TEAM_ROLES, DIRECTION_RELATIONS, teamRoleOf, mayDirect, type TeamRole,
 export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS, PEER_LISTING_FRESH_WINDOW_MS, isFreshPeerRow, type ListAgentsToolOptions, type ListAgentsRow } from "./agents/list-agents-tool.js";
 export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
 export { PEER_SESSION_ID_UNGRAMMATICAL_CODE, PEER_RESUPPLY_CAP, type PeerLaneMountVerdict, type PeerInboundDisposition } from "./agents/peer-session-drain.js";
+export { ORG_DELIVERY_REFUSAL_CODES, isOrgDeliveryRefusalCode, mintCrossPrincipalRecord, isGateMintedRecord, PRINCIPAL_INBOX_TRIAGE_POLICIES, principalInboxTriagePolicy, principalInboxSideEffectKey, principalInboxConsumerOf, PRINCIPAL_INBOX_CONSUMER_INVALID_CODE, type PrincipalInboxConsumer, type OrgDeliveryGate, type OrgAuthenticatedSender, type CrossPrincipalBody, type OrgDeliveryOutcome, type OrgDeliveryRefusalCode, type PrincipalInboxTriagePolicy, } from "./agents/org-delivery-gate.js";
+export { PRINCIPAL_INBOX_HANDLE } from "./agents/cross-session-ref.js";
+export { CROSS_PRINCIPAL_MESSAGE_NOTICE } from "./agents/cross-session-envelope.js";
+export { principalInboundLayers } from "./agents/cross-session-judge.js";
+export { PRINCIPAL_INBOX_UNMINTED_CAUSE } from "./agents/peer-session-drain.js";
 export { renderCrossSessionMessageFrame, renderCrossSessionNoticeLine } from "./core/task-notification.js";
 export { PEER_HELD_QUEUE_CAP, PEER_IDLE_SUBSCRIPTION_TTL_MS, PEER_IDLE_SUBSCRIBER_TABLE_CAP, PEER_IDLE_OUTSTANDING_CAP, PEER_IDLE_PRIORS_KEPT, PEER_IDLE_FIRE_DEBOUNCE_MS, PEER_IDLE_HELD_BACKOFF_MS, PEER_IDLE_LABEL_MAX, CROSS_SESSION_DIALOG_EXPIRY_VALUES, CROSS_SESSION_DIALOG_EXPIRY_DEFAULT, resolveCrossSessionDialogExpiry, PEER_HELD_REVIEW_CAUSES, PEER_DELIVERY_RECEIPT_STATES, isPeerDeliveryReceiptState, PEER_DROP_REASONS, peerRecipientSuffix, renderCrossSessionDeliveryNotice, describePeerDropReasons, renderCrossSessionDroppedNotice, PEER_IDLE_NOTICE_KINDS, isPeerIdleNoticeKind, PEER_IDLE_UNAVAILABLE_CAUSES, peerIdleNoticeLabel, formatPeerNoticeClock, renderCrossSessionIdleNotice, describePeerIdleSubscription, type CrossSessionDialogExpiry, type ResolvedCrossSessionDialogExpiry, type PeerDeliveryReceiptState, type PeerDropReason, type PeerIdleNoticeKind, type PeerIdleNoticeFields, } from "./agents/peer-notices.js";
 export { createPeerHeldQueue, peerHeldQueueFor, peerHeldQueueIfAny, peerHeldQueueKey, realPeerClock, type PeerInboundHoldCause, type PeerHeldEntry, type PeerHeldSettlement, type PeerHeldSettleReason, type PeerHeldSettleOutcome, type PeerClock, type PeerHeldQueueSink, type PeerHeldQueueConfig, type PeerHeldQueue, } from "./agents/peer-held-queue.js";
@@ -378,17 +384,17 @@ export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_U
 export { createTaskServer, type TaskServerOptions, type TaskRequestBody, } from "./server/http.js";
 export { clearStaleToolResults, editBudget, type ContextEditOptions, } from "./core/context-edit.js";
 export { createOpenAIBrain, type OpenAIBrainConfig } from "./brain/openai.js";
-export { createAnthropicBrain, type AnthropicBrainConfig } from "./brain/anthropic.js";
+export { createAnthropicBrain, ANTHROPIC_DEFAULT_BASE_URL, type AnthropicBrainConfig } from "./brain/anthropic.js";
 export { createOpenResponsesBrain, type OpenResponsesBrainConfig } from "./brain/open-responses.js";
 export { FABLE_5_COMPAT, fable5Model } from "./brain/model-presets.js";
 export { createFailoverBrain } from "./brain/failover.js";
-export { createRoutingBrain, type RoutingBrainOptions } from "./brain/routing.js";
+export { createRoutingBrain, brainLaneOf, type RoutingBrainOptions } from "./brain/routing.js";
 export { repairTextToolCalls } from "./brain/tool-call-repair.js";
 export { createCircuitBreakerBrain, type CircuitBreakerOptions, type BreakerState, type BreakerSnapshot, type BreakerPhase, CIRCUIT_OPEN_MARKER, } from "./brain/circuit-breaker.js";
 export { createDegradingBrain, readDegradation, DEGRADED_DIAGNOSTIC_TYPE, type DegradingBrainOptions, type DegradeReason, type DegradationInfo, } from "./brain/degrading.js";
 export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { WAITING_FIRST_TOKEN_AFTER_MS, WAITING_FIRST_TOKEN_EVERY_MS } from "./brain/stream-engine.js";
-export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, resolveRequestRootOf, joinRequestUrl, hasAuthCarrier, __resetCredentialOriginBindings, type RoutePairingStatus, } from "./brain/route-adjudicator.js";
+export { adjudicateModelRoute, resolveRouteCredential, admitRouteRequest, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, resolveRequestRootOf, joinRequestUrl, hasAuthCarrier, __resetCredentialOriginBindings, type RoutePairingStatus, } from "./brain/route-adjudicator.js";
 export { ROUTE_CREDENTIAL_SOURCES, ROUTE_CARRIERS, ROUTE_CARRIER_BAGS, REQUEST_ROOT_ORIGINS, ROUTE_CREDENTIAL_PAIRING, requestRouteOf, routePairingRowOf, type RequestRoute, type RouteCarrier, type RouteCarrierBag, type RequestRootOrigin, type RouteCredentialPairingRow, } from "./brain/request-route.js";
 export type { RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, } from "./internal/llm.js";
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS, type RouteAdjudicationVector } from "./brain/route-conformance.js";
@@ -405,5 +411,5 @@ export { RULE_OFFERS_ABSENCES, type RuleOffersAbsence } from "./core/ask-origin.
 export { BOUND_GRANT_ABSENCES, type BoundGrantAbsence } from "./core/skill-grant-binding.js";
 export { DISPOSABLE_PROMPT_SECTIONS, type DisposablePromptSection, type PromptSectionEntry, type PromptSectionAuthor, type McpInstructionsEntry } from "./core/prompt-section-seat.js";
 export type { McpRevocationLedger, McpMountIdentity } from "./core/mcp-server-spec.js";
-export { readMcpToolAxes } from "./core/mcp-server-spec.js";
-export type { McpToolAxesRead } from "./core/mcp-server-spec.js";
+export { readToolAxes, readMcpToolAxes } from "./core/mcp-server-spec.js";
+export type { ToolAxesRead, ToolAxesSurface } from "./core/mcp-server-spec.js";